topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Thursday March 28, 2024, 11:32 am
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: Rename folder and files before deleting  (Read 14174 times)

dcwul62

  • Supporting Member
  • Joined in 2013
  • **
  • default avatar
  • Posts: 336
    • View Profile
    • Donate to Member
Rename folder and files before deleting
« on: May 05, 2018, 08:50 AM »
When running Recuva deleted file names are displayed.
Secure deleting files on SSD is not recommended (TRIM should take care of it?)

I just ran Recuva on an SSD and it showed a lot of files and foldernames, even though TRIM is active.

Up front, I don't know whether it is workable or not, but I just  -wondered- ...

Say that once you are deleting a file (for the sake of argument, let's call it 'safe delete')
So, let's say you are 'safe deleting' a file, using 'some kind of special instruction/or tool'
it would then go as follows:
the file will be renamed to some random name e.g. l2LCAnnRpIMkUTmpKf0q.tst 
then it will be moved to a scratch folder with some random name as well, for instance, it is moved to D:\lCQgD45dJSEX1DFLkW8E
then it will be deleted there.
Recuva will show weird paths and weird name, making it at least difficult to guess what it is about.

Right now, within Recuva, one can often guess based on path names.

Again, it is just an idea!

There may be tools that secure delete files on SSD, but they do not clear the MFT records.


4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #1 on: May 05, 2018, 08:11 PM »
TRIM speeds up write access by periodically clearing blocks marked for deletion rather than wait to delete when a write is required, (simplified version).

AFAIK, SSDs have Secure Erase which only act on the whole drive but the SSD has to support it.

Regarding the MFT:
http://www.moo0.com/...ftware/AntiRecovery/

If you're that concerned about someone able to see what's been on the SSD, Bitlocker it, (or some other encryption).
« Last Edit: May 06, 2018, 01:09 AM by 4wd »

dcwul62

  • Supporting Member
  • Joined in 2013
  • **
  • default avatar
  • Posts: 336
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #2 on: May 06, 2018, 01:32 AM »
Yes, the SSD software (Samsung Magician) also provides secure erase.
That covers the entire drive and will probably run for a century.

Other software,  like Eraser,  can securely delete files only, which in most cases is enough.
In most cases there is no need to secure erase each and every file, but only specific ones, or specific folders.

However, in such cases, after securely deleting files and after running recovery software the file names / folder names are displayed.
Even though files can not be recovered, names show what they were about.

That's the background of my idea.

So, as securely deleting  -files-  on SSD is not possible, at least not that I know of, then the only thing left is to 'hide' them as best as possible
using random names and random 'scratch' folder.
So:
- randomize file name
- create a scratch folder with a random name
- move file to that folder
- delete that folder

Anyway, that is just an idea.



4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #3 on: May 06, 2018, 07:57 AM »
So:
- randomize file name
- create a scratch folder with a random name
- move file to that folder
- delete that folder

I find your logic a little flawed with this procedure to supposedly disguise what folder a file originally came from in the event anyone tries to recover deleted files.

  • The original folder still exists, pretty much any attempt to disguise where any file came from is pointless since if anyone is interested enough to care about the name of that folder they should rightly assume that any and possibly all files came from that folder regardless of their name or where they now appear on the drive.
  • Given 1, it's enough to securely delete the file in the original folder without screwing around wasting write cycles on the SSD.


4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #4 on: May 06, 2018, 09:21 PM »
A clean SSD with just one folder and two files, Recuva set for DeepScan, show everything:

Two files on an SSD:
2018-05-07 11_56_46-Piriform Recuva.pngRename folder and files before deleting

Two files deleted, top one using DOpus secure delete, (since you were asking over there), the bottom using Moo0 FileShredder:
2018-05-07 12_02_12-Piriform Recuva.pngRename folder and files before deleting

After Moo0 Anti-Recovery (with just the MFT options selected, takes a couple of seconds):
2018-05-07 12_07_55-Piriform Recuva.pngRename folder and files before deleting

And just for an added extra, single file deleted with Microsoft's own SDelete:
2018-05-07 14_00_06-Piriform Recuva.pngRename folder and files before deleting

You'll note the file name has partially become the original folder name, you could easily write a PoSh script that renames the folder, runs SDelete on the file(s), and then changes the folder name back.
« Last Edit: May 06, 2018, 11:16 PM by 4wd »

dcwul62

  • Supporting Member
  • Joined in 2013
  • **
  • default avatar
  • Posts: 336
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #5 on: May 07, 2018, 12:20 AM »
Is this a SSD you are using in this test? Fileshreders like Eraser, BCWipe, etc. work well on conventional HDD's
but they say they don't work well on a SSD.
On a SSD 'TRIM' should do the work.
When you run Recuva on your SSD (if you have one), then you will see that a lot of data is revealed.

Opus itself does have a secure delete of files.
Recuva will then show a very long file name consisting of random characters, but it also shows the original folder name.

Ideally it would look like this screenshot, all with Z...ZZ  names and folders

-

dcwul62

  • Supporting Member
  • Joined in 2013
  • **
  • default avatar
  • Posts: 336
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #6 on: May 07, 2018, 01:59 AM »
For your info:
1) I formatted a (small) partition on conventional HDD... - see A.
2) then Recuva deep scan - see B
3) thereafter CCleaner Wipe Free Space - see C
4) then again Recuva deep scan - see D


SnagIt-07052018 084456.pngRename folder and files before deleting

=
SnagIt-07052018 084625.pngRename folder and files before deleting

=
SnagIt-07052018 085134.pngRename folder and files before deleting

=

4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #7 on: May 07, 2018, 05:06 AM »
Is this a SSD you are using in this test? Fileshreders like Eraser, BCWipe, etc. work well on conventional HDD's
but they say they don't work well on a SSD.

I have to wonder whether you read anything, the very first lines in my post:

A clean SSD with just one folder and two files, Recuva set for DeepScan, show everything:

Two files on an SSD:

And if you looked at the images:

2018-05-07 11_56_46-Piriform Recuva.png

Apacer make SSDs, not HDDs.

Opus itself does have a secure delete of files.

Two files deleted, top one using DOpus secure delete, (since you were asking over there), the bottom using Moo0 FileShredder:

As shown in my 2nd image, the one where it shows FileShredder has trashed the name, the file size, the attributes, and the timestamp, (and it does it twice).

Ideally it would look like this screenshot, all with Z...ZZ  names and folders

Or indeed my 3rd screenshot, you know, the one with completely randomised names.

When you run Recuva on your SSD (if you have one), then you will see that a lot of data is revealed.

The very first image shows everything Recuva found on the SSD before I deleted anything, the following images show everything it found on the SSD after deleting the two files.

How about you just download FileShredder, Anti-Recovery, and/or SDelete and try them on your system?

PS.
... SSD (if you have one) ...

I have eight (8) of them.
« Last Edit: May 07, 2018, 09:09 PM by 4wd »

dcwul62

  • Supporting Member
  • Joined in 2013
  • **
  • default avatar
  • Posts: 336
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #8 on: May 08, 2018, 08:42 AM »
Sorry.... overlooked it multiple times, too much focused on on the thought that using file shredders on SSD should be avoided.
Hence assumed I was looking at HDD screenshots. Sorry again.
Will check out reviews on file shredders.
Thanks again for taking the time.

« Last Edit: May 08, 2018, 09:12 AM by dcwul62 »

skwire

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 5,286
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #9 on: May 09, 2018, 09:17 AM »
@dcwul62: Would you like me to mark this thread as solved or did you want to test a few of those programs and report back your findings first?

dcwul62

  • Supporting Member
  • Joined in 2013
  • **
  • default avatar
  • Posts: 336
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #10 on: May 10, 2018, 12:38 AM »
Yes, you can mark this thread as closed.
I did a CCleaner Wipe Drive on my SSD yesterday, results are as per attachment.

@4WD - thanks.

-
2018-05-10_07-27-20.pngRename folder and files before deleting
-

4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Rename folder and files before deleting
« Reply #11 on: May 10, 2018, 12:54 AM »
I did a CCleaner Wipe Drive on my SSD yesterday, results are as per attachment.

That is going to take a fair bit more time than just doing specific files and clearing the MFT plus it puts unneeded write cycles on the SSD.

ie. If a block is wiped on the first running of CCleaner and there has been no change to it, (no data written to that block), when you next run CCleaner it will wipe an already wiped block.

It's not designed to keep track of block writes and only wipe those that have been used between runs, you're needlessly shortening the life of your SSD, (considering it will do 1 -> 3 writes on each and every block that is marked as free).

... too much focused on on the thought that using file shredders on SSD should be avoided.

Unnecessary writes to the SSD should be avoided, it's why all my temp files go to a RAM drive.
« Last Edit: May 10, 2018, 01:05 AM by 4wd »